CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2020-35505

A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Score
4.4 medium
Published
2021-05-28
Links
NVD · cve.org

Affected ports (2)

PortPackageVersionStatusMaintainer
emulators/qemu-cheriqemu-cheri0.d20260108unaddressedbrooks@FreeBSD.org
emulators/qemu-user-staticqemu-user-static3.1.0_16unaddressedemulation@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>qemu-cheri</name>
	<range><lt>6.0.0</lt></range>
      </package>
      <package>
	<name>qemu-user-static</name>
	<range><lt>6.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A NULL pointer dereference flaw was found in the am53c974 SCSI host
	bus adapter emulation of QEMU in versions before 6.0.0. This issue
	occurs while handling the 'Information Transfer' command. This flaw
	allows a privileged guest user to crash the QEMU process on the host,
	resulting in a denial of service. The highest threat from this
	vulnerability is to system availability.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2020-35505</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-35505</url>
    </references>
    <dates>
      <discovery>2021-05-28</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>